GNU Fileutils Directory Removal Race Condition Vulnerability
BID:4266
Info
GNU Fileutils Directory Removal Race Condition Vulnerability
| Bugtraq ID: | 4266 |
| Class: | Race Condition Error |
| CVE: |
CVE-2002-0435 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 11 2002 12:00AM |
| Updated: | Mar 07 2007 11:25PM |
| Credit: | Vulnerability discovery credited to Wojciech Purczynski <[email protected]>. |
| Vulnerable: |
Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10.0_x86 Sun Solaris 10.0 GNU fileutils 4.1.6 GNU fileutils 4.1 GNU fileutils 4.0.36 GNU fileutils 4.0 Avaya Interactive Response 1.3 Avaya Interactive Response 1.2.1 Avaya Interactive Response 2.0 Avaya Interactive Response Avaya CMS Server 13.0 Avaya CMS Server 12.0 Avaya CMS Server 11.0 Avaya CMS Server 9.0 Avaya CMS Server 13.1 |
| Not Vulnerable: | |
Discussion
GNU Fileutils Directory Removal Race Condition Vulnerability
GNU fileutils is a freely available, open-source file manager. It is designed for use on Linux and other UNIX-like operating systems.
Under some circumstances, a local user may be able to remove the root directory of the system. Due to inadequate file locking and an insecure 'chdir' call, an attacker could move files from the '/tmp' directory into the root directory. The problem occurs with a directory tree that has several single subdirectories in '/tmp' when the root user tries to remove the directories recursively. If the root user tries to recursively remove the directory tree from '/tmp' and if the directory tree is writable by another user, then the user could move a high-level directory into '/tmp' after the 'rm' program has descended the tree. The 'rm' program would then ascend from the '/tmp' directory to the root directory, recursively removing the contents of the root directory.
GNU fileutils is a freely available, open-source file manager. It is designed for use on Linux and other UNIX-like operating systems.
Under some circumstances, a local user may be able to remove the root directory of the system. Due to inadequate file locking and an insecure 'chdir' call, an attacker could move files from the '/tmp' directory into the root directory. The problem occurs with a directory tree that has several single subdirectories in '/tmp' when the root user tries to remove the directories recursively. If the root user tries to recursively remove the directory tree from '/tmp' and if the directory tree is writable by another user, then the user could move a high-level directory into '/tmp' after the 'rm' program has descended the tree. The 'rm' program would then ascend from the '/tmp' directory to the root directory, recursively removing the contents of the root directory.